Design, Modelling and Analysis of a Workflow Reconfiguration

Transcription

1 Design, Modelling and Analysis of a Workflow Reconfiguration Manuel Mazzara 1, Faisal Abouzaid 2, Nicola Dragoni 3, and Anirban Bhattacharyya 1 1 Newcastle University, Newcastle upon Tyne, UK {Manuel.Mazzara, Anirban.Bhattacharyya}@ncl.ac.uk 2 École Polytechnique de Montréal, Canada m.abouzaid@polymtl.ca 3 Technical University of Denmark (DTU), Copenhagen ndra@imm.dtu.dk Abstract. This paper describes a case study involving the reconfiguration of an office workflow. We state the requirements on a system implementing the workflow and its reconfiguration, and describe the system s design in BPMN. We then use an asynchronous π-calculus and W ebπ to model the design and to verify whether or not it will meet the requirements. In the process, we evaluate the formalisms for their suitability for the modelling and analysis of dynamic reconfiguration of dependable systems. 1 Introduction Competition drives technological development, and the development of dependable systems is no exception. Thus, modern dependable systems are required to be more flexible, available and dependable than their predecessors, and dynamic reconfiguration is one way of achieving these requirements. A significant amount of research has been performed on hardware reconfiguration (see [5] and [9]), but little has been done for reconfiguration of services, especially regarding computational models, formalisms and methods appropriate to the service domain. Furthermore, much of the current research assumes that reconfiguration can be instantaneous, or that the environment can wait during reconfiguration for a service to become available (see [14] and [13]). These assumptions are unrealistic in the service domain. For example, instantaneous mode change in a distributed system is generally not possible, because the system usually has no well-defined global state at a specific instant (due to significant communication delays). Also, waiting for the reconfiguration to complete is not acceptable if (as a result) the environment becomes dangerously unstable or the service provider loses revenue by the environment aborting the service request. These observations lead to the conclusion that further research is required on dynamic reconfiguration of dependable services, and especially on its formal foundations, modelling and verification. In a preliminary paper [16], we examined a number of well-known formalisms for their suitability for reconfigurable The invited speaker is Manuel Mazzara.

2 M. Mazzara et al.: Workflow Reconfiguration 11 dependable systems. In this paper, we focus on one of the formalisms (W ebπ ) and compare it to a π-calculus in order to perform a deeper analysis than was possible in [16]. We use a more complex case study involving the reconfiguration of an office workflow for order processing, define the requirements on a system implementing the workflow and its reconfiguration, and describe the design of a system in BPMN (see section 2). We then use an asynchronous π-calculus with summation (in section 3) and W ebπ [18] (in section 4) to model the design and to verify whether or not the design will meet the reconfiguration requirements. We chose process algebras because they are designed to model interaction between concurrent activities. An asynchronous π-calculus was selected because π-calculi are designed to model link reconfiguration, and asynchrony is suitable for modelling communication in distributed systems. W ebπ was selected because it is designed to model composition of web services. Thus, the contribution of this paper is to identify strengths and weaknesses of an asynchronous π-calculus with summation and W ebπ for modelling dynamic reconfiguration and verifying requirements (discussed in section 5). This evaluation may be useful to system designers intending to use formalisms to design dynamically reconfigurable systems, and also to researchers intending to design better formalisms for the design of dynamically reconfigurable systems. 2 Office Workflow: Requirements and Design This case study describes dynamic reconfiguration of an office workflow for order processing that is commonly found in large and medium-sized organizations [7]. These workflows typically handle large numbers of orders. Furthermore, the organizational environment of a workflow can change in structure, procedures, policies and legal obligations in a manner unforseen by the original designers of the workflow. Therefore, it is necessary to support the unplanned change of these workflows. Furthermore, the state of an order in the old configuration may not correspond to any state of the order in the new configuration. These factors, taken in combination, imply that instantaneous reconfiguration of a workflow is not always possible; neither is it practical to delay or abort large numbers of orders because the workflow is being reconfigured. The only other possibility is to allow overlapping modes for the workflow during its reconfiguration. 2.1 Requirements A given organization handles its orders from existing customers using a number of activities arranged according to the following procedure: 1. Order Receipt: an order for a product is received from a customer. The order includes customer identity and product identity information. 2. Evaluation: the product identity is used to perform an inventory check on the availability of the product. The customer identity is used to perform a credit check on the customer using an external service. If both the checks are positive, the order is accepted for processing; otherwise the order is rejected.

3 12 PNSE 11 Petri Nets and Software Engineering 3. Rejection: if the order is rejected, a notification of rejection is sent to the customer and the workflow terminates. 4. If the order is to be processed, the following two activities are performed concurrently: (a) Billing: the customer is billed for the total cost of the goods ordered plus shipping costs. (b) Shipping: the goods are shipped to the customer. 5. Archiving: the order is archived for future reference. 6. Confirmation: a notification of successful completion of the order is sent to the customer. In addition, for any given order, Order Receipt must precede Evaluation, which must precede Rejection or Billing and Shipping. After some time, managers notice that lack of synchronisation between the Billing and Shipping activities is causing delays between the receipt of bills and the receipt of goods that are unacceptable to customers. Therefore, the managers decide to change the order processing procedure, so that Billing is performed before Shipping (instead of performing the two activities concurrently). During the transition interval from one procedure to the other, the following requirements must be met: 1. The result of the Evaluation activity for any given order should not be affected by the change in procedure. 2. All accepted orders must be billed and shipped exactly once, then archived, then confirmed. 3. All orders accepted after the change in procedure must be processed according to the new procedure. 2.2 Design We designed the system implementing the office workflow using the Business Process Modeling Notation (BPMN) [4]. We chose BPMN because it is a widely used graphical tool for designing business processes. In fact, BPMN is a standard for business process modelling, and is maintained by the Object Management Group (see The system is designed as a collection of eight pools: Office Workflow, Order Generator, Credit Check, Inventory Check, Reconf. Region, Bill&Ship1, Bill&Ship2 and Archive. The different pools represent different functional entities, and each pool can be implemented as a separate concurrent task (see Figure 1). Office Workflow coordinates the entire workflow: it receives a request from a customer, and makes a synchronous call to Order Generator to create an order. It then calls Credit Check (with the order) to check the creditworthiness of the customer, and tests the returned value using an Exclusive Data-Based Gateway. If the test is positive, Office Workflow calls Inventory Check (with the order) to check the availability of the ordered item, and tests the returned value. If either of the two tests is negative, the customer is notified of the rejected order

4 M. Mazzara et al.: Workflow Reconfiguration 23 Correctness Criteria The standard notion of correctness used in process algebras is congruence based on bisimulation. However, our requirements are not all expressible as congruences between processes. The first and third requirements can be expressed as congruences, and so bisimulation can be used in the reasoning. The second requirement cannot be expressed as a congruence because the old and new configurations are not behaviourally congruent. So, we have used reasoning based on simulation instead. Thus, we found that congruence as it has been used in section 4 is not always applicable for verifying the correctness of our models. Therefore, in section 3 we have investigated model checking. The discussion leads us to the following: 1. It is easier to model workflow reconfiguration in Webπ than in the asynchronous π-calculus. However, modelling would be even easier in a synchronous version of Webπ. 2. Model checking is more widely applicable than equational reasoning based on congruences for verifying workflow reconfiguration. These two conclusions seem to have wider applicability than just reconfiguration of workflows; but this needs to be verified. Future Work We intend to proceed with a deeper analysis of alternative designs for this case study, and evaluate other formalisms, such as VDM [2] and Petri nets [23]. We are also working on a BPEL implementation of the system. We also need larger industrial case studies to help us to design and evaluate formalisms for the modelling and analysis of dynamic reconfiguration. Acknowledgments This work is partly funded by the EPSRC under the terms of a graduate studentship. The paper has been improved by conversations with John Fitzgerald, Cliff Jones, Alexander Romanovsky, Jeremy Bryans, Gudmund Grov, Mario Bravetti, Massimo Strano, Michele Mazzucco, Paolo Missier and Mu Zhou. We also want to thank members of the Reconfiguration Interest Group (in particular, Kamarul Abdul Basit, Carl Gamble and Richard Payne), the Dependability Group (at Newcastle University) and the EU FP7 DEPLOY Project (Industrial deployment of system engineering methods providing high dependability and productivity). References 1. R. M. Amadio, I. Castellani, and D. Sangiorgi. On bisimulations for the asynchronous π-calculus. Theoretical Computer Science, 195(2): , D. Bjorner and C. B. Jones, editors. The Vienna Development Method: The Meta- Language, volume 61 of Lecture Notes in Computer Science. Springer, G. Boudol. Asynchrony and the π-calculus. rapport de recherche Technical report, INRIA, Sophia-Antipolis, BPMN. Bpmn - business process modeling notation.

5 24 PNSE 11 Petri Nets and Software Engineering 5. A. Carter. Using dynamically reconfigurable hardware in real-time communications systems: Literature survey. Technical report, Computer Laboratory, University of Cambridge, November N. Dragoni and M. Mazzara. A formal semantics for the ws-bpel recovery framework - the pi-calculus way. In WS-FM 09, Springer Verlag, C. Ellis, K. Keddara, and G. Rozenberg. Dynamic change within workflow systems. In Proceedings of the Conference on Organizational Computing Systems (COOCS 1995). ACM, G. L. Ferrari, S. Gnesi, U. Montanari, and M. Pistore. A model-checking verification environment for mobile processes. ACM Transactions on Software Engineering and Methodology, 12(4): , P. Garcia, K. Compton, M. Schulte, E. Blem, and W. Fu. An overview of reconfigurable hardware in embedded systems. EURASIP J. Embedded Syst., 2006, January K. Honda and M. Tokoro. An object calculus for asynchronous communication. In P. America, editor, European Conference on Object-Oriented Programming (ECOOP), pages Lecture Notes in Computer Science 512, N. Kobayashi. Typical: Type-based static analyzer for the pi-calculus. koba/typical/. 12. R. Lucchi and M. Mazzara. A pi-calculus based semantics for ws-bpel. Journal of Logic and Algebraic Programming, 70(1):96 118, J. Magee, N. Dulay, and J. Kramer. Structuring parallel and distributed programs. Software Engineering Journal (Special Issue), 8(2):73 82, J. Magee, J. Kramer, and M. Sloman. Constructing distributed systems in conic. IEEE Transactions on Software Engineering, 15(6): , M. Mazzara. Towards Abstractions for Web Services Composition. PhD thesis, Department of Computer Science, University of Bologna, M. Mazzara and A. Bhattacharyya. On modelling and analysis of dynamic reconfiguration of dependable real-time systems. In DEPEND, International Conference on Dependability, M. Mazzara and S. Govoni. A case study of web services orchestration. In COOR- DINATION, pages 1 16, M. Mazzara and I. Lanese. Towards a unifying theory for web services composition. In WS-FM, pages , R. Milner. Functions as processes. Mathematical Structures in Computer Science, 2(2): , R. Milner. Communicating and Mobile Systems: the Pi-Calculus. Cambridge University Press, R. Milner, J. Parrow, and D. Walker. Modal logics for mobile processes. Theoretical Computer Science, C. Palamidessi. Comparing the expressive power of the synchronous and the asynchronous pi-calculus. In Mathematical Structures in Computer Science, pages ACM, C. A. Petri. Kommunikation mit Automaten. PhD thesis, Fakultät Matematik und Physik, Technische Universität Darmstadt, 1962.